hxxps://ligshtshot[.]site/

Analysis

user interaction
yes
max time kernel
28s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ligshtshot.site/
Sample260701-wref8ads6x

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	msedge.exe
2804	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274029517385680"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{CEBA637A-A052-4173-ABDF-A21040862BD1}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 1972	928	msedge.exe	88
PID 928 wrote to memory of 4056	928	msedge.exe	89
PID 928 wrote to memory of 1708	928	msedge.exe	90
PID 928 wrote to memory of 4056	928	msedge.exe	89
PID 928 wrote to memory of 4056	928	msedge.exe	89
PID 928 wrote to memory of 5040	928	msedge.exe	92
PID 928 wrote to memory of 5040	928	msedge.exe	92
PID 928 wrote to memory of 1492	928	msedge.exe	93
PID 928 wrote to memory of 1492	928	msedge.exe	93
PID 928 wrote to memory of 1492	928	msedge.exe	93
PID 928 wrote to memory of 5576	928	msedge.exe	94
PID 928 wrote to memory of 5576	928	msedge.exe	94
PID 928 wrote to memory of 5576	928	msedge.exe	94
PID 928 wrote to memory of 3384	928	msedge.exe	95
PID 928 wrote to memory of 3384	928	msedge.exe	95
PID 928 wrote to memory of 3384	928	msedge.exe	95
PID 928 wrote to memory of 3676	928	msedge.exe	96
PID 928 wrote to memory of 3676	928	msedge.exe	96
PID 928 wrote to memory of 3676	928	msedge.exe	96
PID 928 wrote to memory of 1724	928	msedge.exe	97
PID 928 wrote to memory of 1724	928	msedge.exe	97
PID 928 wrote to memory of 1724	928	msedge.exe	97
PID 928 wrote to memory of 2604	928	msedge.exe	98
PID 928 wrote to memory of 2604	928	msedge.exe	98
PID 928 wrote to memory of 3908	928	msedge.exe	100
PID 928 wrote to memory of 3908	928	msedge.exe	100
PID 928 wrote to memory of 1136	928	msedge.exe	101
PID 928 wrote to memory of 1136	928	msedge.exe	101
PID 928 wrote to memory of 5008	928	msedge.exe	104
PID 928 wrote to memory of 3368	928	msedge.exe	107
PID 3368 wrote to memory of 1256	3368	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ligshtshot.site/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffd182cc188,0x7ffd182cc194,0x7ffd182cc1a0
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,13204443821331059696,5164199932359624855,262144 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,7429064648521345704,16908627744295969507,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,13840255403976818239,12408831256224685912,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,13927986543223337282,12637970475590905233,2097152 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,11778391388014817860,7276696165806139949,2097152 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4464890748143516846,14226257380626600593,2097152 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,18085259038937751357,8253924360083060212,2097152 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5260,i,16486322945599352495,2118251066412386639,2097152 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,17590291297675364947,4473308675737088059,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,14484307129268783121,2816736389541106404,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,2610436607368860219,13370841447009452217,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,18274019336475445564,10174524949670103623,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,18274019336475445564,10174524949670103623,524288 --field-trial-handle=2388,i,4148705500788851853,17883452270356149507,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffd182cc188,0x7ffd182cc194,0x7ffd182cc1a0
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,10762455407152632996,2843690245285140030,262144 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:2
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,3675813388001530997,14822384651201868363,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,515016419357041203,14532985583011386846,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:13
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,4532360230564274473,6323649397511084665,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,4532360230564274473,6323649397511084665,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,12253051850768793267,4247132488008905951,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,11972887874335124676,10398455478970114164,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,17171170077336285678,15080783000565637177,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7623003760911066722,7584844834382957209,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5133810617070597660,5618758713662029107,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,4161103129845182106,11908953643259962520,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,10195313703895782976,10247079978254292519,524288 --field-trial-handle=3280,i,13403492799145583176,14308152014734944974,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
    3⤵
    PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9d396ca42a510439c1a22b90a40d48276b91d435958f3d13e470b4b90b6f605
MD5 c92eb54e6c011e0a1c31f0c54be8c41e
SHA1 512ffb64d76fbb8cea03d8e903e4272a154e8205
SHA512 ddb09c5acdb0828823a67ec325eb10270dde4823240afc3a4ec87ae400298c3a3a2aecb1ddff5c31bded84f020e3bb3848688a4efc27ec8d879e8bce5cf701ed
TLSH
T1E3D02311375CFDC9C945203754504651F52849E3655B4B445054D81DCC741C357974EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cba357ebb03d73875f37bc70649047cd077a77b95c3a7dfad89eb86d51b84196
MD5 7347b2b3fc5656b2a1f891cd663ed2dc
SHA1 7cdb18dec05ce61115cb770d1a2b050e96713afb
SHA512 78f537666af28b05e81fc3202ce30cc326411f895ff7a3b32eae98e87929ba18d705f974dfa8e5f1068898f087ec87b51493a75379da27d6b92c1dd85f068366
TLSH
T110D02221379CFC48C9872033F8529362F2A90AA0B81FCE444060D52DCC74A83139B0FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b355217490609630d53a0dd18740e4e9dfb027ac1581cc7be8ea0223f8dbbc9b
MD5 1f687011eccbb388dfc341c3009e63fa
SHA1 fe9b5039c398f5824fdbefa60688906e60b370df
SHA512 ac4b6e623366f525f587ba774d86a3497955ecdcd77952b4012ea88e05e793c8963809a31115dd4ea365e5e5132e8358fd2a5a45b3f151cd28131f75d5a2b7c8
TLSH
T12EE02BAED921ED770DFC475C20700785FA5513172680550F763C82198FB16374686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 8842404e20ac8de1d769da550916e55d4cfd874f4ed96c76f370ea72e87e832c
MD5 49b40a4f50ea7b18dc9e2f3945c6d571
SHA1 e203921843a09dd1e5aa723474f6ee6e822d3d1e
SHA512 7127b61b8d0987cec7eae6a8071a256b08b6fbbdf11135996e8e32cae2f0c69f9d0ad23ae359e6142ec035e7de352ccc9be4a38d494ed1da8884214aeeb3cea6
SSDEEP 192:/21czQSx6Tbxn7VpCP+lF5+DEDjHdLDyan/6BT/J9r4tu6kDmyofhnh+naBd5rBY:/2Aix7V38DKbFd6xR9r4dyscnaZr3dA
TLSH
T14513073D3A40AE67D2DB213D91AF5F325730C268E8D69E1713353A84D74A34ABE5F224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 5faf0ba7045f124ba0457af61d21e6731b3a3495b00445911f85b28226bba16e
MD5 eb94a84c7187d0702cb77f92f9834440
SHA1 72ecf63d3c4a4036c26e0feb102b4d89e3c5bfa0
SHA512 91c19a502f1cad4307d91cbe14a83ea700ad49d3b61467c94d68e3330f08f681cbc338a158aa31fb8f75bbdec49bc95255813e485f39fd4a3b6b6e0c16246714
SSDEEP 1536:b4UgL/1LL/CRsWyUh7hvOnrOx9/b9Rlio8/yLtk0TL/BL/9L/T:bvgL/RL/OhX7HL/BL/9L/
TLSH
T14B4460F71951A00BCBA842F6D2133E3DD177850E7CD1E8E9E5784C856825F22BABDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 80439f872211e090cad2795e9bc3ea453aa0fba5e603071526ba2d7ae80f9e24
MD5 118d69c02f3ff6e2a8a1041f9d57bc5a
SHA1 ce6e850c70161e9df2124aa07138bb0a6948476c
SHA512 7ae2e114e10548fdb1ebc3909459510901671b0e3d0183f988f49e67c193e9b4f64e597bfdd1e9fd500d6fb1ae7a8e0d94ab6556e29eb80ba5d9a31a4b34ae0b
SSDEEP 3072:uv9G+zNcwpiH8e4F0MDktWXXyBJxbVs9:uQMywp7vVXXAJxV
TLSH
T1522549EECB682C83CF6B8670B0E0D9077E712183B658D0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4c11744d7373b43681ad97682e69a773b67c71878f19d9f68e2efa2a12cf6dc8
MD5 25f6380e842d563518e32a5650fda69e
SHA1 a176925a3744dfb290b9d630439f1e453d532a39
SHA512 bb0370f6495514657f6e9d21429db552bd9ab718e45714962a4342b25a56a1a2d8a919cd65bafeaf939bfa4f5d1d9682f7c17be9383ce8515774f8a8baac0043
SSDEEP 24576:1HDePkAfZFa81TV4noXBuJccZGVp5z3P/tY+tQqAbabA0iU:1S7fZg81TqoXBuGrHtYOQqAmbArU
TLSH
T103167DEDCA6898C3CD639A30B4F0E9577C7413C3F9A4C1D28858C584416BBC5BFAA66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 950KB
SHA256 100d33fba97a81e54dd4664511505b33f2e386234ef226b00b216d4e173bc5ad
MD5 8a3d0b7d3f13eb522ff90bd3744cf1f2
SHA1 2bfdd0aa0c2e1f8cbda4471df71c7247d28aedf2
SHA512 0f309ec3a55c7743a325d12154bcd92783251fe5d0d1b2cf523c597fa578d5c5447dd92d44d9d9117963a33a3eee05377917ac051e2d15d3e82ac667ce833250
SSDEEP 12288:3YcffE2PRWzmy788d69WIJ/43y98bplZMGImV3yfJVRQjVB6tPv:3YofE2PRW6Id6ZapplulmV3ZP6p
TLSH
T17E2502C61AD4451DF0F1A071E2DA1F05A6A31AFC24BA5747BC7D8BB883F64E11B217CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f2d8468fadea1f9f7cc14400191cb90c7e6fff1217e893d951aa60a17ea3dd3b
MD5 e394bd3296e99d105fe85ae53de9c6e0
SHA1 686066182378c62243bd241bb336288d063f4503
SHA512 c7d2a8d9e71837da8b6638ce0b2df15729d15e86c7d8809d228a590952b2db89ef4ed03977c4d325a7d96af216bf458c320fe85714c28ffacaef651365cec3e9
TLSH
T11871C650332B97F3DB392AB805E65DB9FE7ED4BA42472E20ECB3917870127C654225B1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bc41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bc41.TMP
Size 3KB
SHA256 628414c8330f16c733c57a27ab0fc07ab5d89161f88ad2fa58d2981b29ba2f36
MD5 65a77b1d1a25bab95eed8a57044af078
SHA1 17f512d0ef83894b2828b3e6aaa39168e0dfa343
SHA512 e11142d8c4728ef522eb2054f3ebfe2a8e0cf9bca0db2291d1ec6e659005f07a7cd6ca7dee5ce2fc7f750eddc680349874fd270df21a6d647fe227f7d2303b6a
TLSH
T17961E650332B97F3DB396AB805E64DB9FE7ED4BA42072E20ECB3917870127C654225B1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 dd9730af8cfeb622272dc5f1545755831058b435f87e9b4883dc00c4ce5e1930
MD5 3fa37797d3ce54daac911cbf99df03e9
SHA1 5d1f4de11d30bfad0083beec0165f68803476f0c
SHA512 a2ba2010460272be05f569a4d9d426f137ec085b8c92b22819b9171c314103902eae435f1cf0ba975e13a36698e15daaf5b1f65e9b3b84cfbcbdbedc9798a7b0
TLSH
T1B3E0D8A897C6C91D766134C6453C7B8AA1E43493DAD5AD0327048CC07606401FB6279A
MD5 SHA1 SHA512 TLSH

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 2f546f0e8ab4b36525cd6bad8fa946fc06f4965e15c9f4ca36e05341b75e3f2b
MD5 50c76fe6bfa4a72c5051e7c22ca95419
SHA1 af36f0709bdc8bf65de5c3781f18f5b568fe1a1a
SHA512 6cd61188aa4a82050e37d8260a83773ed25aab1766412cec7af1500df0f765d622631d0fbc5cc19de528a4d54005e121ec279a208a448e77699cbe883edece1a
SSDEEP 48:TtD4jJ/0UC+lf5lj3CdayPtkeOWxT+ZesxZkGpL:hD4jJ/JXj3CdGbG+ZXoGpL
TLSH
T1EFE29F44E232F6AFCFED1D3DA7D8B2B5C5D8202C91DC5A50137D79E604A96F8648A01D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 342B
SHA256 39dfdec86949f152a1471442545245ac5f3372b56428a6f61dffac0a3ec159e7
MD5 829a3c6987490c82e6ba954662c1d61b
SHA1 3799630075c4e24b21e810bb5896dd5ecb96c9b5
SHA512 0fe38650c2f79854b11bb4f6564fa45639e74cf8e644f7913c55cc92ee0ebe58c20307360aa83432e6521c046c39ccf2d2e1098695cae563817d0f4af593e30a
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 dfad69da81ad4f41974017e76687e490c5979b3bfe7dc75e967256f816941ae2
MD5 f48585f420654d8b1eca42584d9a45f6
SHA1 70855e35dabc0f7e1bda8d6f9032b4ed9959b05b
SHA512 5a859b620298ac4c072e888d08548488c1283f39f36663499637440e5bc8920b0ab970f4c971d4c351f012c1b4d8ababe4b53a6cd8c23fe7453b5d56140c8ddc
TLSH
T196E0262845C8C92EB15478D7867E634882EA3893BBC8B942270E88806201E42A3863D4
MD5 SHA1 SHA512 TLSH

Submit Download

ExtensionActivityEdge

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge
Size 32KB
SHA256 475f12864892aa7b74be2630191c6d8f0223c403e99ba88c526ed36a19ab91bd
MD5 eec0746e532e1aa3315a9bcbaaec4a2e
SHA1 b3092a8c10c8f3ae716f6e3bc8beec6eccc0e4d4
SHA512 dbb680492930aaf08078604ab14d0d1e63853a735d0a896644c8eb4d4ed380aa94f0cc9f573a04a7abc1c06fa1ad335a082b07b9242e5b463f1c06605f0a2bbf
SSDEEP 24:TLlWK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/uReQQ:TWm+/9ZW943WOT/
TLSH
T156E24B2A5E7C7121CD667136AC2194665CB910DA977336F23EE000796F8228BC535CEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 67d00bbf2c5b09d579bf0746b90265c6f5fadba775d17e868a61ba198dfc8e98
MD5 d34a3b5011dcf7b251e94718e9ada875
SHA1 5b80c102bb44a875336e75372f8e07e608a78f14
SHA512 abaa7904e0fa9e1f98e6fc7d5eabb3219e27ef6cda43609c344c335a44384bc2f2d1c5632fba4950b9ed9c4a0c1175a912d264ad566d670ed14ebaac7eb9ae83
SSDEEP 96:r7yWmtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/RHbbEOVpZf24JkMfXSFR+CFq:r7yW5H+bF+UI3iWGVoWN3qL/tVVV63
TLSH
T1F2241F4F5F352722CDBD913669E744A35C7CF03F8B1226DA6C6114B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 1e9676c688d3a82e76fbd0976707041d8f6e8fc1b5775ecaf163fb1fbe07289b
MD5 cd7ef301822711fc4f6609262a24f9f6
SHA1 23475faf0b1f928e80303ce59beec75ef2b46c06
SHA512 21ed64ba2157404d133c00e270c46b6a103ed0bf9f04820bd947602ee6049353238c2204ef739700a08dfb9e0a76584ca3b1bb8187252643949186b32427c335
TLSH
T16BE0D87045CDC92E6144749B427D774DC3E0791BDB88AA01AB05D881B441506A7926D5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 af5117f6953b33d8994148ae866b93a96f22daa1e149e0abf1ae2db84c902abb
MD5 ee6fdf20c181cd56f536a0fc1c24b84b
SHA1 7b876bc77cbf772599c5dd8b6aed74c8e45313b4
SHA512 93bb15f6dcf5d1ff78390a241fea418a90042d0e829cad74f0f2a741fffb747c70e8ba7afb0ca2eeca6cad75254162eca1b3aad7bf0e184d27f7b9ffa1b3501f
SSDEEP 48:Txk/LopFMaty423w/a9NUuT4YXwLAHXgw5eEBb+h/olwi+47pdBRTQx:qDeMatha9qYXFXgw5ec+0B+qpVTQx
TLSH
T17EB2336E1F316111D4F54FB6EFD188163D3C110DC7B332699D4460F28DA3AAAB2591BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 353ebecbb146dfa106ccdb9fb9b9111405de660e0568a090f5e120cc7c1f999a
MD5 9769acb339ae4a9945ed2d24ad68ca17
SHA1 c05bd0b37329d15b70f84093d2a29173fcfa60b3
SHA512 4a29b564c72f615af1a69757aa180c68c07c7fa4e3f9657aa8db05cb4bd7f62d324db97794c0b311ae4d2d9d5b40633a8a3542cd5decec2cbc43e1a4d9ec93d8
SSDEEP 96:D88O502pWmVbPjhncVzBUfXwUQ1VmaiwjGj6PhA:D835020mVbPjhnG1UfXwUQ1VmaieGj6u
TLSH
T125B19DB7C7E4C66DD81195F5AB143E2BCE1D095883383D26C9E49F8B93E2471D20154F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 7bf22c7af83f2c13991df862ae595b6ea0c144d0638f02d6d4996220dc63b192
MD5 a90d242ec07a8d8868a9ed2c97cf6fae
SHA1 431bc0f05d8fdff411e39833b485eef5500eb6e5
SHA512 e049d1d108e78e15cb8bee5f4497c579f7ef955b73b475316cc08a5930fab6a656e8832a5555c2259dfa013a7996a535f7045792a98d498558af4702412decf7
TLSH
T1B9017B5384BFF07B3028A97E3F90BC0F557AA039422574F4D963823CB0852E72F1A465
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c06ef1992e047baf6881746e3129250c77e014f53a7f981664169d19ee1c004b
MD5 dce4bcec272e702e43e834977883b29c
SHA1 fa9233fab729e7b74c8c8899a0638a786cb547e9
SHA512 486a744cb62cad477b9567ef9fa2ee570c1c751262ea5085aff0384547bbfc145cd97b0b2bc1970050aabe6df8c552cfe593d42e6d45e492d61bc720d1591372
SSDEEP 192:sxR2ReyM/jK1Ml8w7Z/fes4twVWfBzoA8pYl/g6+WNYQ2/YTiVBGAIgIJ:sxR2IlZ/fes4mgUs/52//ps
TLSH
T18852E915A638593BCCDBD209FA55BF53D2F81573A2901E44AAFC8B0C45E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b3c4ed281a4aea469c777b78e3e4cbd8918ed461a7b2d6426ec5f38a95e53514
MD5 878b1e57c9bec12998517e89623579fc
SHA1 6ca7a39084e31c96ae7411d0afc15c8b38d9addc
SHA512 d0b63456991bf77a48fc93b2e59ae04ef2a5ed3e754fa414167035c2c2017a82b90482523951fb0d255abeffe87a2d3cc611cd363ba3069a738a394d2f46ef14
SSDEEP 192:sxR4ReyM/jK1Ml8lFZ/fesKWpVVtwVW/BzoA7FZpYl/g6+WNJwo/VrYzjAVggAIT:sxR4IQZ/fesKWvVmgz9s/5dVrHyI
TLSH
T1E862E816A534597BCCDBD209FA55BF63D2F81572A2901E44AAFC8A0C41E77ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e1c8f8b31cc8a68c0b93798a41eaf078d40e74260bababf4d49e5d87a73b26ef
MD5 ffa7947d705d2f513dc45328e24af937
SHA1 a417c3eba77a011e103082560e4596f9a5f97b09
SHA512 01f2d87e7ca7029995260887a5e73b0cf119d131fd33b43e0a7c66527d9a81cea4e520f2acef0cb11d10266889152ea5226cb3c8fba20a94f8deac22e80cc570
SSDEEP 192:sxR4ReyM/jK1Ml8w7Z/fesltwVWfBzoA7FZpYl/g6+WNYTXdYT/VBGAIgDwJ:sxR4IlZ/feslmgT9s/58dMpI
TLSH
T14862D915A638597BCCDBD219FA45BF53D6F80573A2901E44AAFC8B0C41E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7a9f5051bc4f28b3dac1bfc91e519a635f26043eec37178c50c55f001a9ea6f1
MD5 9126612d35c4f519acdb09789c4db518
SHA1 e4e2bcf8edc6918528a283617d6e4ef49891173d
SHA512 30acc2676dd1c3b9e3f4892a81c2b20c638ae29eb9c67848d4060572f1258ce8591d87a161035d1e8165a0e066b2f76b6d8671b1626132970c2cc15c158a34a6
SSDEEP 768:RGqOYrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJzFYeroqW8jn:RGqOYrWgTvfiXu1jaERY1/Sn
TLSH
T10FC20A3F640CC77E4F804AADEC25BE9A6DD801CB97984D5447EA894C03CA7FB511A4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 77dbebd0ec0af9264d6ae65a268c13a795b82b743cd8a9996c57db5631cc45d7
MD5 36903f915c695087c1218df3140bd369
SHA1 6e6dd4fda6585d49c5cd9131d8a4afd3487a9335
SHA512 997f387c9665bbe01c200e666fa2dcc11e0a903fbf07877ab2bddaeaaf7b13aeda8bab8e8db225e70a2496b1ff4285dd893669f9d1268f939ff679de1803b194
TLSH
T107E0866407CDC97D70EB3097027D974892E8782BDBC87D523F48C991A143955F7922D5
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 1c673de34b41c2d48bd363c45a8f22cca7cbd8966872a16a3b4583123ea776a8
MD5 89646fb59d0c00fbdc5f23d437e7b7b6
SHA1 fb4cfd864d3ad605ed68468a18a99631264daa81
SHA512 158664a326e8d16344951efaee7698cc6a6d9160a4ee1ddcbce8b61f22b2fbd425ce2e493b62ea9a33c8dfbf9ee8e77df72bcb72676317f7ae09d56833fe0c69
TLSH
T1DAB0124037009D49D4C60A700640DF406724F2011140C973DC985F118D152BC3F46CD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 6f2f20b55dcd7ab9d465b33c28e3a8e89defe6ca0ee93e28270465677e122866
MD5 d9223c3f5ab8118d7b49978cc5787ca5
SHA1 5e776918dd8b60a5f78a1ccba6e791fea027860c
SHA512 f306590c3add64b692656598db7b07f746433ae3f930ac273d79ae4fbb5de62dc9cc03966df500d7cf3bad26c1b75fa14b22b0a849e2154c556db2af7ba986f0
TLSH
T119E0D87027CACA2E71C730DB426DF748C2E2781FDBC86D617F0E9480A207540B343294
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 2818bd3df0b4c016d2d1f5c055a1bde0ddeadabc451d1690337a606ce3ec8f48
MD5 5f7d4f5e1e86bdd8558e69984ad71e8c
SHA1 ad461e8107047f46d6131a6fa24b6c9f55454f47
SHA512 9d7d03ce4598e094266338dc21ad82d1529e333a49240ccbc22e2fb6e9806a956e7637b0ba0d07502b21225b61afc3e7be5ed4fc142236b8e70e59ad0f857e91
TLSH
T1A7E026B086C8CB7D6640F0C7437CA74D82F0FC1BDBC87E46A7188C80B102544B3A66D1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f4f3b29bcd07b2abba579bfd1e97712efcc6d40b133f5c313b40c436eb2be6c9
MD5 10c19029e39b946231b4936d632f8d40
SHA1 612913dffedf305c4b6fb2b7b43acb748640fc38
SHA512 37810b315bae7e0e85c77d54aa1aa5569dc87c3fc34aad53f65c127ffe1af80b088b3796b03991ddfaa4017899d734a724db0291375c04db76c7abeab4dcbf09
SSDEEP 96:KccAKVaGH7kh1DZpVW9yogdVK4kgzVcbDa9puHc9oMmqesWa33gUsK45gesc8M3g:CzH7kh1DZpg9yJdfkgzqbDa9puHc9oMd
TLSH
T185912204323A2A853C3E790D85B2D55FC681B4A37169A42B7FE901E25F67E018EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 f82dbbb8e91522bb15fd6b52ca274596df9955def4891613d68c12904d8980c7
MD5 f4644016763b2cd53beed3d13a528a9a
SHA1 365001249a1d344a4ed23d347c16af8bbaa007fa
SHA512 b4e394c7c871a1d9aef28db256fe6bfe364e4a4f299c58875143e3c388d5eaf3e5e589466a540a2917461d5ce1778381a9b49649a74b1f121a6ff4bdba1db945
SSDEEP 384:DNrRZyCSDnxTIC26MEhIKyll7svbFKfk7:xFZJSDni3LyI1l7svbF9
TLSH
T10644840A7B747001EDE6D9721CB080771E3CB16E8F22A6916DA254694DF3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebAssistDatabase

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebAssistDatabase
Size 14KB
SHA256 eb7586fa359df10b8718abd2fa277e4842e789e2cc48a498b49784271b50c74d
MD5 f2f535067981ad78ea1e7827cd1faa14
SHA1 b684c1fdddf0c06291160b7b5a574945d9d965d0
SHA512 30b281c498094c8dd0bbb568f56d81660efb82e52c71e0c02ca448d42bd720abc242beca284775718f53e4b6a68c97d6caf46251a242bf7f9d07a6415749b73d
SSDEEP 24:LLTGxhK3thdkSI5QjUsEGcGBXp22iSBgllJGt:DEK3tjkSI5IUltGhp22iSBgllJW
TLSH
T1BE529AEFEA743222DCEA43719FC001E17E7A553E8FC1E60354D610212EB4A51A31E6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 de845ed9915dede9bf53f4e4ee5a1fb61015cc07d34595f4fe26e9c73e7320c7
MD5 e3f1e5c4977f861a539ea5ec14768c80
SHA1 1e86f278d9e3244ac84d66c40910f0880733c979
SHA512 1ccad26ac91ab72d3f58f9a4e2899b7faa15ef31359c6aa78c18407c5879ad4c0180ff8ebcc78b13905bbdc290ade0052246f9770941bf1381613b1f3f7f1ea5
TLSH
T1C3E08684132A68DD7E8CBA48C1367A43D0C4BE67970D49713FDF46D48B4480B8A2DDB6
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 cb09a9bc291c2a8709af29b4c116243270f6867ca14a39338c7159d9b002bba3
MD5 da07fbe36066e7c591e32e9667d1c366
SHA1 c9aaea3a98f203baf21e7c8ba4200e9dbb3b9ce3
SHA512 e40adcbeb5fd1d98184cd6ac30ec6291d282baa753e8540dbccda855e44735263cfcbf6f7a1fae451311367ad7361747cae910e3c3a42eb3075cf97f6c6f54de
SSDEEP 192:kiQsIIIzbzMIMlEYcYqCyOFdmAs/li/DQ2sEH:FQsIIIzbzMIM2BP4FNs952s
TLSH
T18342835A16061B77C04F5B7A536286546BD94C8200B2A63D326F3D2F8DF3FA782D52F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 259c350ce50b9807d81ea509e9bc79afc5b1db9496e38a6c31e77ffe7c9e0049
MD5 3b85510cc6d23f546b59ffa3f927c1de
SHA1 3a90c65ffcca4a9e320b798984ee746bc091569f
SHA512 f0e719a3296a325513528726804988861d1920c92116ae4452ad661589987a9bf2836d4a5a6cadf73bb71991b6fedf9b528547b8010983f6f24942d6d8b03660
TLSH
T108E02620AAD8C9AFB06534C7013D6389C2C43C53FF886A072F05C4C4A005946BBA62D1
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 dcc253b67f88ac1288d5a821450d80368291105caec186ca76da326784dc108f
MD5 63b2481c4169e528c7904e71bf74dad9
SHA1 c8af8bfd8d9cd04569895b761f89e06c6f618336
SHA512 86a255d2268760f1b3ed9c61d7e6829c207e5e2dccaa3dbde2e8db1d4d15836c20ad22e0d52e803784896593f8a7600497aa4c5b41add840fafffc0e04f82f52
TLSH
T1D5210495F330D109E149827E507E9B391738E8128FB8EC0F447920746EB1B540E4B2E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 474fb17fb821f2a68c3fc49916325f25f0f46f473e3be42662c6d3304d3fa05c
MD5 a37586a773fe2b51cdc5511b632ba957
SHA1 b1e49c31b0ffd072d2f378297d6f1749267c9ca1
SHA512 7d0b2f5ab20e58b158e075635612e65134c5814d189770b1ed168e846b01755a9cd4d6b5c5cec50cfe34e48ef6bdd631dd6dc3c0fa6cce58882ec623536769ff
TLSH
T1D4E0202065D4C55F706034C7017EA78982DA7C53FF847E012F01CC8457059427B462D1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b5ab43d88123be7432c57e1407993e9d4b867209c7b427d3e836c7b43644ee53
MD5 84dceb093275722b46201b9b6d013b8a
SHA1 e926a505c4431e5419b88f908b4a8ae9d79d6d04
SHA512 f7f532477bc695b20685c4853ba7c41f064cffb02f78b7bf2069e4caebc11e6d54966e620d6039dbaf5c9aa157f92daf7f101a074e6e0acb651fc561fb9c9d52
SSDEEP 3:MsEllllkEthXllkl2zEflKRKt:/M/xT02zDKt
TLSH
T1CA44040DFFC04C05C5011031C151C7501371D5300D53574734D104335CC7D401C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d9636406775249fbdd9678d9be6411827137767ce7bc21aa9c65855ead76b3e0
MD5 0299d1f401576bad14d04bccc8cf6696
SHA1 51102b08e24623645ff58a9ca7a8aa5f6577987a
SHA512 2ec89414954f44bb65aefb6ae756928dff2ef2e8215029f5775987428bcaa8f3147f4691fba51e39d43bf5aeca667c949035199bea55d84d512cbb44b865f9ff
SSDEEP 768:krv+4UNbdj3HH6lBWDXodOiIyN8Y1M1fmBnZvv0F:kbsbl3HH/DXodI11wk
TLSH
T1D113CF32E864D9778CF39288F51332437FF491A78AC91B449ADD6B0E4647AFE130B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 47KB
SHA256 7c48308084a8c459085d06d7eed98534ad0b14ff48dcf088a79b144d1a8f8bc4
MD5 ef535f754716fe71bb0fd72b39765a8a
SHA1 b4c490cc51c6c6134369fa958b53277997019f05
SHA512 47443aec305e7522d6dad167fe61897c69dccb8dfe648ac4d267805cf09d864c96d970d6e4a3cb2d8cf88e6ead0741e447e9bb6b49a9305befcc81e81f52e8bd
SSDEEP 768:Arv+4UNbdZ3gH6PBWVXodOiIyN8Y1M1fmBnZiia9w1c8Kzxx:AbsbH3gH1VXodI11LR9w1ctzxx
TLSH
T15423BE3DAC24897F88AE7B48620F6A276EF44277D6B50958E7C8170DC1339ADF307865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 55ca7885c490c334d3c05618eb93ce7eb1e519625c2db98a43c327c29dcbd0c7
MD5 b94d2988e387bed67e9e5008269a18cf
SHA1 191f980e675cfc685d6f7180158b4ad1fdd755b7
SHA512 699667e1515c477d36bd0dd5ff16b6c16d6fb99c834976d70c24216e6d981bcb14f2909b8311c09f022368212f4cf277678d3fafa4e41c8bb44cce7bb535e112
SSDEEP 768:Yrv+4UNbdj306QPW+XodOiIyN8Y1M1fmBnlSVNv0B:Ybsbl30q+XodI11Hj8
TLSH
T15603CF32E864D5778CF28288F54772437FF491A38BC50B94DADD6B0E4647AEE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 de2ee3fad88f5c53f359eacc6c47e7f07536e310cf386043e678d410a6792c39
MD5 958c5088302e43fd110b1c9a34f46b1c
SHA1 645326c85a22c3079abad186c62a9381cb92942a
SHA512 fa4f55f95a019f2f489646d54b37eb40fd5e97508bc6d463da55bf274c957659be3043e9ef7e701a093e5e706b7b17844ebe3e67cbd678f2978eaf8c3984767d
SSDEEP 3:MsEllllkEthXllkl2zEflcn+/:/M/xT02zP+/
TLSH
T1DA4404057FC10407CD1510314051C3511370D5100D115F433CF304735DC75407C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

035bf3a9-1e64-47d5-83de-041d8d0dc575.tmp

Path C:\Users\Admin\AppData\Local\Temp\035bf3a9-1e64-47d5-83de-041d8d0dc575.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 2ca6d8222080d05d71f40cdf3197571d9ea0490759eeda7f4d00eddb864b9a2a
MD5 de0590e202c747e8fa6d93d3283984f3
SHA1 deac485ea1188c2cf4f4b3bcf12e31d0821519dd
SHA512 a723aaf7e4c97a1874cd09aa5c588be4495d0c730d300e37ef4708d7c86c3e6bea5e1455634f98820a03af016a419d88fe19a05939a79b77f73bf10bae7f227c
TLSH
T16F11D2E03522777F67D387C9A0760C846920F051432F6A9CEA4B4124FE1CEE0A3AE7C5
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3368_711766726\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads